✦Privacy Policy

Introduction

BlueVeta ("we", "us", "our") is operated by TBM Investing LLC. This Privacy Policy explains how we collect, use, store, and share information when you use blueveta.com or any BlueVeta product or service (the "Service").

We comply with the EU General Data Protection Regulation (GDPR). By using BlueVeta, you agree to the practices described in this policy.

Information We Collect

We collect information you provide directly:

• Account information: name, email address, password (hashed), and any optional profile details
• Brand information: brand name, logo, color preferences, tone of voice, target audience, and any other inputs you provide via the brief modal or "Tell us more" flows
• Uploaded content: product photos and any files you upload for processing
• Payment information: handled by our payment processor (Stripe). We do NOT store full credit card numbers. We retain transaction IDs, last 4 digits of the card, billing address, and amounts charged.
• Communications: messages you send to [email protected] or through in-app feedback

We collect information automatically:

• Usage data: pages visited, features used, time spent, generation events
• Device data: browser type, operating system, screen size, language, IP address
• Cookies and similar technologies (see Cookies section below)

We do NOT collect:

• Biometric data
• Government identification numbers
• Health information
• Children's data (the Service is not intended for users under 18)

How We Use Your Information

We use your information to:

• Provide the Service: generate marketing assets from your uploaded photos, store your brand memory, deliver downloads
• Improve the Service: use your inputs and outputs to improve your results (brand memory and prompt tuning), debug issues, and measure feature performance
• Communicate with you: send transactional emails (purchases, downloads, account changes), product updates, and (with your consent) marketing emails
• Process payments: charge for packs and plans, issue refunds, prevent fraud
• Comply with legal obligations: tax records, government requests, enforcement of our Terms

Uploaded Photos and Generated Content

Photos you upload are stored on our servers (currently Cloudflare R2) for the duration of your account plus 7 days after deletion, then permanently removed. Generated outputs are stored under your account and remain accessible until you delete them.

You retain ownership of photos you upload and generated outputs you receive (subject to the license terms in our Terms of Service).

We may use real uploaded photos and generated outputs, internally and at our discretion, to test and train our own AI systems in order to improve BlueVeta's accuracy and features. This is strictly internal — we do not publish, display, or share your photos outside BlueVeta, and we will never use an identifiable photo of you, your products, or your brand in marketing, a case study, or any other public-facing use without your explicit consent.

AI Processing

Your uploaded photos and brand inputs are processed by AI models to generate marketing assets. This processing happens on our servers and through third-party AI providers (currently Anthropic, for text and vision, and fal.ai, for image and video generation). These providers process your data under their own terms, per request. See "Uploaded Photos and Generated Content" above for how we use real photos to test, train, and improve our own tools internally.

Brand Memory

When you save brand preferences (voice, visual style, audience, avoid lists), this information is stored under your account and used to personalize future generations. You can view, edit, or delete your brand memory at any time from your account settings.

Sharing Your Information

We share information with:

• Service providers: payment processing (Stripe), email delivery (Brevo), hosting (Cloudflare), analytics (Google Analytics 4), AI generation (Anthropic, fal.ai, and other providers as we add them)
• Legal authorities: when required by law or to protect our rights, property, or safety
• Business transfers: in the event of merger, acquisition, or asset sale, your information may transfer to the acquiring entity

We do NOT sell your personal information to third parties.

Cookies

We use cookies and similar technologies for:

• Essential functions: keeping you logged in, remembering your preferences
• Analytics: understanding how the Service is used (Google Analytics 4)
• Marketing: measuring campaign effectiveness (only after you consent)

You can control cookies through your browser settings. Blocking essential cookies will prevent the Service from functioning properly.

We also use Cloudflare Turnstile, an invisible check that helps us tell real visitors apart from bots when you sign up, send us a message, save a demo by email, or create a pack. It loads only on those forms, runs silently, does not show you a puzzle or challenge, and is used only to prevent abuse. Because it is a strictly necessary security measure, it is not switched off by the cookie banner. See Cloudflare's Turnstile Privacy Addendum for details on how it processes data.

Data Retention

We retain your data:

• Account data: for the life of your account plus 7 days after deletion
• Uploaded photos: same as account data
• Generated outputs: same as account data
• Payment records: 7 years (to meet applicable tax and recordkeeping requirements)
• Communications: 3 years
• Anonymized analytics: indefinite

Your Rights

Under GDPR, you have the right to:

• Access: request a copy of all data we hold about you
• Correction: request corrections to inaccurate data
• Deletion: request deletion of your account and associated data
• Portability: receive your data in a machine-readable format
• Objection: object to specific uses of your data
• Withdraw consent: opt out of marketing communications or analytics cookies at any time

To exercise any of these rights, email office@blueveta.com. We will respond within 30 days.

Security

We implement industry-standard security measures including encryption in transit (HTTPS), encryption at rest, access controls, and regular security audits. No system is perfectly secure — if we discover a data breach affecting your personal information, we will notify you within 72 hours of becoming aware.

Access to your account data by BlueVeta staff is limited to what's needed to provide support, investigate a reported problem, or improve the Service (see "How We Use Your Information" above) — never for any other purpose, and never shared externally beyond the service providers already listed in this policy.

For support and quality-assurance purposes, authorized staff can view your dashboard as you would see it. Every use of this is logged (who, when, and the stated reason), it can never be used to change your password, email, or two-factor settings, or to delete your account, and it is never used to view your data out of curiosity.

International Transfers

BlueVeta is operated by TBM Investing LLC, a U.S. limited liability company. By using the Service, you understand and agree that your data may be transferred to and processed in the United States and other countries where our infrastructure or service providers operate. We rely on standard contractual clauses and equivalent protections for international transfers.

Children's Privacy

BlueVeta is not intended for users under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact office@blueveta.com and we will delete it.

Changes to This Policy

We may update this policy from time to time. Material changes will be announced via email and a prominent notice on the Service. The "Last updated" date at the top of this page indicates the latest revision.

Contact

Questions about this Privacy Policy? Email office@blueveta.com.